1. Providing Moonshot access to OpenStack
Vincent Giersch - vg66
MSc Computer Security - University of Kent
Moonshot
Supervisor: David Chadwick

2. Contents
• Moonshot overview
• OpenStack overview
• Providing Moonshot access to OpenStack
• Federated Keystone
• How it will work ?
• Technical architecture
• Roadmap
• Questions

3. Moonshot Overview
Moonshot

4. Moonshot Federated authentication and authorization
For web and non-web services and applications

5. Example: IE à Apache
Moonshot
Source: Janet

6. Example: PuTTY à OpenSSH
Moonshot
Source: Janet

7. Moonshot technologies
Moonshot is built on:
• Strong authentication: EAP/RADIUS
• Strong authorisation: SAML
• Easy service/application integration: SASL/GSS-API
Standardisation approaching completion within the
Internet Engineering Task Force (IETF)
Moonshot

8. OpenStack Overview

9. Starting the virtualization...
Source: OpenStack Foundation

10. Starting the virtualization...
Host 1 Host 2 Host 3 Host 4, etc.
Hypervisor
(VMWare ESX, Citrix XEN Server, KVM, etc.)
Hardware abstraction for each server
Source: OpenStack Foundation

11. ... but how to manage the resources ?
Provisioning ? User management ?

12. Add the missing cloud management layer
APIs Self-service for users
Creates Automates
Pools of Resources deployment

13. Main components of OpenStack
Applications
APIs
Identity Compute Storage Network
Keystone Nova Swift Quantum
Standard Hardware

14. Moonshot
+

15. Federated Keystone
Allows to use external Identity Providers (IdP)
Easy user provisioning
Provides Single Sign On (SSO) to the users
Developed as a Keystone middleware

16. How it will work ?

17. How it will work ?
Asks a list of
Identity providers
User Keystone

18. How it will work ?
Returns the Identity
Providers available
User Keystone

19. How it will work ?
Chooses a IdP
(Moonshot)
User Keystone

20. How it will work ?
Returns
Moonshot details
User Keystone

21. How it will work ?
Chooses the identity
that he will use
User Keystone

22. How it will work ?
Negotiate
authentication
User Keystone Identity
Provider

23. How it will work ?
Returns
list of tenants
User Keystone

24. How it will work ?
Chooses a tenant
User Keystone

25. How it will work ?
Returns
a tenant token
User Keystone

26. How it will work ?
User Keystone

27. Technical architecture
OpenStack Client OpenStack Keystone Identity Provider

28. Technical architecture
Federated Keystone Federated Keystone
HTTP
OpenStack Client OpenStack Keystone Identity Provider

29. Technical architecture
Moonshot module Moonshot module
Federated Keystone Federated Keystone
HTTP
OpenStack Client OpenStack Keystone Identity Provider

30. Technical architecture
GSS-API GSS-API AAA AAA
GSS AAA
Moonshot module EAP mech Moonshot module transport
Federated Keystone Federated Keystone
HTTP
OpenStack Client OpenStack Keystone Identity Provider

31. Technical architecture
EAP method
EAP peer EAP server
GSS-API GSS-API AAA AAA
GSS AAA
Moonshot module EAP mech Moonshot module transport
Federated Keystone Federated Keystone
HTTP
OpenStack Client OpenStack Keystone Identity Provider

32. Project roadmap
• Study of the existing Moonshot implementations (e.g. Apache / Firefox).
• Fork the PyKerberos library to add flexibility in the usage of the GSS-API
C library.
• Study of the potential needed improvements of the Keystone Federated
protocol.
• Implement the authentication / authorization Moonshot module.
• Validation testing using a OpenStack client (e.g. python-swiftclient).

33. Questions ?
Moonshot
Vincent Giersch - vg66